> For the complete documentation index, see [llms.txt](https://docs.veedna.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.veedna.com/gold-open-source-gos/gold-packages/integrating-lineaje-gos-artifactory-proxy-into-your-ci-cd-pipeline/npm-integration.md). # npm Integration NPM resolves packages using the registry configured in [.npmrc](https://docs.npmjs.com/cli/v11/configuring-npm/npmrc). To route NPM traffic through the Lineaje Proxy, configure `.npmrc` to use the Proxy’s NPM endpoint and authenticate with a Lineaje Personal Access Token (PAT). ## Getting Started {% stepper %} {% step %} ### Create a Lineaje Personal Access Token (PAT) Follow the below instructions. {% content-ref url="/pages/C95d39E9JtH0LtbtfHfT" %} [Authentication](/gold-open-source-gos/gold-packages/integrating-lineaje-gos-artifactory-proxy-into-your-ci-cd-pipeline/authentication.md) {% endcontent-ref %} {% endstep %} {% step %} ### Store the Lineaje PAT in a secure location For example, add the token as an environmental variable: {% code overflow="wrap" %} ```bash export NPM_AUTH_TOKEN="by9...dPQ==" ``` {% endcode %} For CICD pipelines, like GitHub Actions, this token can be stored as a repository-level secret or an organization-level secret. A sample GitHub Action is added below for your reference. {% endstep %} {% step %} ### Configure .npmrc Create a `.npmrc` file in the root of the Node.js project. {% code overflow="wrap" %} ```bash registry=https://observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/ //observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/:_authToken=${NPM_AUTH_TOKEN} ``` {% endcode %} You can choose between observe mode or enforce mode. More details are here: {% content-ref url="/pages/05R19ZwuZtHVy9iEqChD" %} [Modes of Operation](/gold-open-source-gos/gold-packages/what-is-lineaje-gold-open-source-gos-artifactory-proxy/modes-of-operation.md) {% endcontent-ref %} {% hint style="warning" %} Never commit a .npmrc file that contains a real token or password. {% endhint %} {% endstep %} {% step %} ### Install NPM packages Now NPM is configured to connect with Lineaje GOS Artifactory and download secure NPM packages through the Lineaje Proxy. {% code overflow="wrap" %} ```shellscript npm install ``` {% endcode %} {% endstep %} {% endstepper %} ## Sample Configurations ### GitHub Actions This guide explains how to configure a GitHub Actions workflow to install NPM dependencies from Lineaje GOS Artifactory and run unit tests. #### 1. Create the GitHub Secret Create a repository-level or organization-level secret to store the Lineaje PAT. 1. Open your GitHub repository. 2. Go to **Settings**. 3. Open **Secrets and variables**. 4. Select **Actions**. 5. Click **New repository secret**. Create the following secret: ``` NPM_AUTH_TOKEN ``` Set the value to the Lineaje PAT. > This token will be used by `actions/setup-node` to authenticate with the Lineaje GOS Artifactory NPM registry. #### 2. Add the GitHub Actions Workflow Create the following workflow file in your repository: ``` .github/workflows/npm-tests-gos-artifactory.yml ``` Add the below content: ```yaml name: NPM Run Tests with GOS Artifactory on: pull_request: branches: [main] workflow_dispatch: inputs: mode: description: "FortKnox mode" required: false default: "observe" type: choice options: - observe - enforce jobs: test: runs-on: ubuntu-latest steps: - name: Checkout code uses: actions/checkout@v4 - name: Set FortKnox mode run: | MODE="${{ github.event.inputs.mode || 'observe' }}" echo "FORTKNOX_MODE=$MODE" >> "$GITHUB_ENV" echo "Using FortKnox mode: $MODE" - name: Set up Node.js env: NODE_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }} uses: actions/setup-node@v4 with: node-version: '20' registry-url: https://${FORTKNOX_MODE}.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/ - name: Install dependencies run: npm install - name: Run tests run: node --test test/*.test.js ``` ### Jenkins This guide explains how to configure Jenkins to build a Node.js project using FortKnox Artifactory as the NPM registry. #### 1. Configure Node.js in Jenkins 1. Go to **Manage Jenkins**. 2. Open **Tools** or **Global Tool Configuration**. 3. Find the **NodeJS installations** section. 4. Click **Add NodeJS**. 5. Set the name as: ``` NodeJS ``` 6. Select the required Node.js version. 7. Save the configuration. > The name must match the Jenkinsfile value: > > ```groovy > nodejs 'NodeJS' > ``` #### 2. Add Artifactory Credentials in Jenkins 1. Go to **Manage Jenkins**. 2. Open **Credentials**. 3. Select the appropriate credentials scope, usually: ``` Jenkins → Global credentials ``` 4. Click **Add Credentials**. 5. Select credential type: ``` Username with password ``` 6. Enter your SBOM360 email as username and the Lineaje PAT as password. 7. Set the credential ID, for example: ``` fortknox-artifactory-creds ``` 8. Save the credential. This credential ID will be used in the Jenkinsfile: ```groovy ARTIFACTORY_CREDS = credentials('fortknox-artifactory-creds') ``` #### 3. Add `.npmrc` to the Project Create a `.npmrc` file in the root of the Node.js project. ``` registry=https:///artifactory/api/npm// always-auth=true ///artifactory/api/npm//:_authToken=${NPM_AUTH_TOKEN} ``` Example: ``` registry=https://observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/ always-auth=true //observe.fortknox.v2.prod.veedna.com/artifactory/api/npm/gos-all-proxy-npm/:_authToken=${NPM_AUTH_TOKEN} ``` #### 4. Add the Jenkinsfile Add the following `Jenkinsfile` to the root of the repository. ```groovy pipeline { agent any tools { // Ensure this NodeJS tool is configured in Jenkins "Global Tool Configuration" nodejs 'NodeJS' } environment { // Jenkins credential should be "Username with password" // Password should contain the Lineaje PAT / auth token ARTIFACTORY_CREDS = credentials('') } stages { stage('Build') { steps { script { // Use only the password/PAT as the NPM auth token // This is for .npmrc entries using _authToken withEnv(["NPM_AUTH_TOKEN=${ARTIFACTORY_CREDS_PSW}"]) { sh 'npm cache clean --force' sh 'npm install --verbose' // Optional: verify packages were resolved from Lineaje FortKnox Artifactory // sh 'grep "resolved" package-lock.json || true' sh 'npm start' } } } } } } ``` ## Verifying Proxy Routing The `--verbose` flag causes npm to log the full tarball URL. Confirm the Proxy URL appears: ``` # Expected in build log: npm http fetch GET 200 https://enforce.fortknox.v2.prod.veedna.com/artifactory/api/npm/ gos-all-proxy-npm/lodash/-/lodash-4.17.21.tgz ``` To detect policy violations, search build logs for the string. To learn more, see [Detecting Policy Violations in Build Logs](broken://pages/Q10H9NLvhjgbZrQoxsqI). --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.veedna.com/gold-open-source-gos/gold-packages/integrating-lineaje-gos-artifactory-proxy-into-your-ci-cd-pipeline/npm-integration.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.